KrypticKryptic Docs

Self-hosting

Updated

The whole platform - PostgreSQL, Redis, four API hosts, and the management dashboard - runs from one docker-compose.yml. A small team can run it in production indefinitely on the free tier.

Prerequisites

  • Docker with Compose v2
  • A host with 2 GB of RAM to spare
  • (production) A reverse proxy terminating TLS in front of the exposed ports

1. Configure

cp .env.example .env

# .env
POSTGRES_PASSWORD=$(openssl rand -hex 24)
TOKEN_KEY=$(openssl rand -hex 48)          # JWT signing key, 64+ chars
MASTER_KEY=$(openssl rand -base64 32)      # encryption master key, exactly 32 bytes
MASTER_KEY_ID=key_master_v1
MANAGEMENT_CLIENT_URL=https://kryptic.example.com
PUBLIC_API_URL=https://api.kryptic.example.com
PUBLIC_DAEMON_BFF_URL=https://daemon.kryptic.example.com

Back up MASTER_KEY somewhere safe. Secrets are encrypted under it (via per-org data keys) - losing it means losing every stored secret. Rotation is supported: set a new MASTER_KEY, move the old one to OldMasterKeys__<keyId>, restart, and the platform rewraps all org keys automatically.

2. Start

docker compose up -d
ServicePortPurpose
management client8080The dashboard your team signs into
Management API5210Serves the dashboard
Daemon BFF5211What developer daemons talk to
Pipelines BFF5212CI/CD machine identities
Secrets API5213Public REST API v1

The Management API runs database migrations on startup; the other hosts wait for it.

3. Create your organization

Open the dashboard, register the first organization, invite your team. Then point developer daemons at your deployment:

KRYPTIC_API=https://daemon.kryptic.example.com kryptic login

Operations

  • Backups - PostgreSQL is the only stateful service (pgdata volume). Standard pg_dump on your schedule.
  • Upgrades - docker compose pull && docker compose up -d. Migrations apply automatically.
  • Multi-instance - the Daemon BFF uses Redis for device logins and rate limits, so API hosts can scale horizontally behind your proxy.

A Helm chart with the same topology is available for Kubernetes deployments - see the repository's helm/ directory.